19 lines
1.6 KiB
Markdown
19 lines
1.6 KiB
Markdown
# Release security scan report
|
|
|
|
Release candidate scans were executed on the Unraid validation host on
|
|
2026-07-27.
|
|
|
|
| Check | Result | Evidence |
|
|
| --- | --- | --- |
|
|
| Production dependency audit | Pass | `pnpm audit --prod` reported no high or critical findings. One moderate `esbuild` development-server advisory remains through `better-auth > drizzle-kit`; the affected development server is not present or exposed in the production web/worker runtime. |
|
|
| Runtime web image | Pass | Trivy 0.69.3 with `--scanners vuln --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1` reported zero findings for the Debian and Node package inventories. |
|
|
| Runtime worker image | Pass | The same Trivy policy reported zero findings. |
|
|
| Repository secret history | Pass | Gitleaks 8.28.0 scanned 153 commits and approximately 4.99 MB with no leaks. Two exact local-development/CI encryption fixtures are narrowly classified in `.gitleaks.toml`; no file-wide exclusion is used. |
|
|
| Production license inventory | Pass | `pnpm licenses list --prod --json` inventoried 161 package records under 0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, CC-BY-4.0, ISC, LGPL-3.0-or-later, MIT, MPL-2.0 and Unlicense. No prohibited or unclassified license was found. |
|
|
| Application security tests | Pass | The configured suite passed 2 files and 11 tests, including dependency and production-boundary checks. |
|
|
|
|
The Node base image originally included unused npm, Corepack and Yarn files
|
|
with high/critical findings in their bundled tooling. Commit `601e59e` removes
|
|
those package managers from long-running runtime images; they remain available
|
|
only in build/migration tooling where required.
|